The Ontario government is planning to change the rules around how health data can be shared, but privacy experts are concerned some reforms could compromise the security of patient information.
The Globe and Mail has obtained a confidential Ministry of Health slide presentation from consultations in October about modernizing Ontario’s Personal Health Information Protection Act, or PHIPA. The document proposes making such data more broadly available to health-care practitioners, as well as innovators and researchers, partly to stimulate economic development.
Unnamed provincial officials wrote that they hope to remove inefficiencies from the system while encouraging data sharing to broadly improve health care.
Privacy experts, however, worry that the ministry’s promises do not contain enough protections to ensure that health data does not wind up in the wrong hands.
When such data is aggregated on a personal scale, it can make treatment easier for patients with multiple health-care practitioners. On a large scale, it has the potential to help researchers find new causes of, or treatments for, disease, as paper-based records and the inability to share data across jurisdictions can make this difficult.
Technology has made this data extremely valuable. When processed with artificial-intelligence techniques such as machine learning, it can reveal patterns that researchers and companies can use to develop new treatments and innovations, with potential benefits for population health and the economy.
But without precautions to anonymize the data, it could be made public by bad actors or used by third parties such as insurers or marketers for profit.
The provincial government announced details of a digital-health strategy Wednesday afternoon, including funding for “virtual video visits” to give Ontario residents easier access to health-care practitioners. Health Minister Christine Elliott said the province plans to streamline local health-care systems and make data more shareable while keeping it secure and private. The plan, she said, will “allow the market to better respond to the needs of the health-care system – and make it easier for businesses of all sizes to compete in Ontario’s digital-health economy.”
But many of the proposed PHIPA changes in the October presentation are still under discussion, ministry spokeswoman Hayley Chazan said – and some are matters of serious concern to privacy advocates.
The document promises to “de-identify” data – removing any information about a patient’s identity from health records – which can then be safely used to find large-scale patterns to improve technologies and health-care practices. It does not, however, promise to de-identify data in all cases where it would be used by others in the health-care system who are not dealing directly with a patient.
“I support strongly de-identified data being used for much-needed health-research purposes,” said former Ontario privacy commissioner Ann Cavoukian, a long-time advocate of embedding privacy principles into data collection. But, she continued, “you cannot make personally identifiable data available for research purposes or management. … It’s far too sensitive, and it reveals a great deal of information about a lot of people.”
In a recent discussion paper about the broader provincial data strategy, the government listed “administrative health data” as a “high-value dataset” that could boost Ontario’s digital economy. The PHIPA consultation document makes numerous references to de-identifying data when being shared for the purposes of research or “innovation purposes that benefit the public,” including for “economic development.”
But even in the private sector, where startups could benefit from anonymized health-care data, there are concerns about the proposals in the October presentation. Sachin Aggarwal, chief executive of Think Research, a Toronto-based startup using artificial-intelligence technology to help health-care officials make decisions on patient treatment, said the consultation document lacks a number of important promises made in other jurisdictions.
Europe’s General Data Protection Regulation, considered a global benchmark for privacy legislation, has strict limits on the processing of health data and requires explicit consent from individuals for data-processing.
“Any changes to PHIPA need to be balanced with new modern rights for citizens, including a right to know how their data is being used and to opt out,” Mr. Aggarwal said. He added that the intention of the consultations was strong and would support innovation. Health-care innovators "gain trust and legitimacy when citizens can make informed decisions about how we can use that data.”
This week, The Wall Street Journal reported that Google had amassed the personal health data of millions of Americans – ostensibly to improve treatments – but had not notified doctors or patients. Although the company said it had taken measures to protect the data and had complied with the law, it nonetheless prompted significant public outrage.
While the province has conducted public consultations on its broader data strategy, its PHIPA modernization plans came as a surprise to privacy advocates who were shown details by The Globe. “These are big things, and they need to be open and transparent, with more public input,” said Teresa Scassa, the Canada research chair in information law and policy at the University of Ottawa.
The document also proposes creating a new offence for “willfully re-identifying de-identified data.” Ms. Scassa said the province would need to outline more nuanced controls around that because, when combined with other population data available to groups such as marketers or insurers, the data sets could be used to profile individuals and communities. This, she continued, “might affect services they receive or don’t or affect insurance premiums.”
Ontario Privacy Commissioner Brian Beamish said in an e-mail Wednesday afternoon that his office was consulted during the PHIPA modernization process, and that they "raised concerns about the commercialization of Ontarians’ heath data, even if properly de-identified, and asked for specific examples of what might constitute ‘innovation.’”
Ms. Chazan said, however, that the province will “continue to consult” with Ontario’s Privacy Commissioner, patients and health-care providers as it moves to the next phase of its digital-health strategy.
Your time is valuable. Have the Top Business Headlines newsletter conveniently delivered to your inbox in the morning or evening. Sign up today.
Josh O’Kane